Risk-projector case study: turning a Firepower CVE stack into a defensible remediation forecast

Security leaders live in the gap between two numbers: the CVSS score assigned at publication and the probability that a vulnerability will be exploited against their environment in the next 90 days. That gap is where a risk projector proves its value. This post walks through a projector run built from a real, noisy input: eight historical Cisco Firepower and ASA advisories dated 2017–2018, most carrying the empty 0.0 base score that appears when a scoring feed lags the advisory. The goal is not to relitigate old CVEs — it is to show, concretely, how a projector converts sparse data into an ordered remediation queue a security team can defend before a steering committee.

The input: an intentionally noisy CVE stack

The projector received the following identifiers in arrival order from the intake feed on 2026-08-12:

CVE-2017-3806   base=0.0   Firepower 4100/9300 CLI shell injection (authN, local)
CVE-2017-3822   base=0.0   FTD/FDM audit log injection (unauthN, remote)
CVE-2017-3887   base=0.0   Firepower SSL detection DoS (unauthN, remote)
CVE-2017-6625   base=0.0   FTD access control DoS (authN, remote)
CVE-2017-6632   base=0.0   Firepower SSL logging DoS (unauthN, remote)
CVE-2018-0101   base=0.0   ASA SSL VPN RCE / reload (unauthN, remote)
CVE-2018-0138   base=0.0   Firepower file-policy bypass via BitTorrent
CVE-2018-0227   base=7.5   ASA SSL VPN client-cert auth bypass (unauthN, remote)

Seven of the eight carried a base score of zero. A naive triage tool drops them to the bottom of the queue or treats them as identical — neither outcome is acceptable. CVE-2018-0101 is the ASA SSL VPN remote code execution issue that became the reference example of an internet-exposed edge RCE. Equating it with a BitTorrent file-policy bypass because both show 0.0 is a triage failure a projector must not reproduce.

What a risk projector actually does

A risk projector is not a scoring rubric. It is a forecasting pipeline that takes three inputs per advisory — vulnerability metadata, an exposure model of your estate, and empirical exploit-timing priors — and returns a probability distribution over a 30-, 90-, or 180-day exploitation horizon.

This case study used:

projector:
  horizon_days: [30, 90, 180]
  features:
    - attack_vector          # network / adjacent / local / physical
    - authentication         # none / single / multi
    - impact_class           # rce / dos / bypass / info / integrity
    - product_exposure       # count of matching CPEs on the perimeter
    - kev_membership         # CISA KEV listing (bool)
    - epss_percentile        # EPSS rolling 30-day percentile
  priors:
    edge_rce_unauthenticated: beta(6, 2)
    edge_dos_unauthenticated: beta(2, 5)
    internal_authn_shell:     beta(1, 8)
    detection_bypass:         beta(2, 6)
  clamp:
    min_probability: 0.005
    max_probability: 0.995

The Beta priors encode a specific institutional belief: unauthenticated edge RCEs are exploited early and often; denial-of-service on the same edge is exploited less predictably; authenticated local shell injection on a hardened appliance rarely leads to novel exploitation without a chained precondition. These priors are fit from five years of KEV additions bucketed by the same feature vector — not pulled from the air.

Walking one advisory through the projector

Consider CVE-2018-0101. The feed delivered base=0.0, but the advisory text carries maximal signal for the edge_rce_unauthenticated prior: SSL VPN, unauthenticated, remote, code-execution-or-reload. The projector overrides the missing CVSS with a synthetic vector derived from the advisory language and evaluates the Beta prior against the estate exposure model. A single perimeter ASA with webvpn enabled produces:

{
  "cve": "CVE-2018-0101",
  "override_cvss": 9.8,
  "features": {
    "attack_vector": "network",
    "authentication": "none",
    "impact_class": "rce",
    "product_exposure": 1,
    "kev_membership": true,
    "epss_percentile": 0.994
  },
  "p_exploit_30d":  0.71,
  "p_exploit_90d":  0.88,
  "p_exploit_180d": 0.93,
  "queue_rank": 1
}

Contrast that with CVE-2018-0138, the BitTorrent file-policy bypass. The feature vector still shows attack_vector=network and authentication=none, but impact_class=bypass and the estate exposure model confirms the perimeter file policy does not cover peer-to-peer traffic. The projector returns a 90-day probability of 0.09 and drops the CVE to the bottom of the queue — not because the advisory is wrong, but because the compensating control neutralizes the practical risk in this estate.

The rest of the stack sorts predictably. CVE-2018-0227 inherits its 7.5 base score and the client-cert bypass language, landing second with a 90-day probability of 0.42. The three DoS advisories (CVE-2017-3887, CVE-2017-6625, CVE-2017-6632) cluster in the middle, separated by whether they require authentication and whether the affected code path is reachable from an untrusted network. CVE-2017-3806, the authenticated local shell injection on the chassis CLI, ranks last for external exploitation but feeds the insider-risk queue. CVE-2017-3822, audit-log injection, routes to the detection-engineering backlog rather than patch operations: its exploitation signature is a logging-integrity problem, not a system-compromise problem.

Why the projector output is defensible

A remediation queue is only useful if the security leader can defend it under challenge. Three properties of the projector enable that.

First, every row carries its provenance. The synthetic CVSS override is stamped with the rule that produced it, so a reviewer who asks "why did you treat a 0.0 as a 9.8" gets a two-line answer, not a shrug.

Second, the priors are versioned. When CISA adds a new class of edge appliance to KEV, the edge_rce_unauthenticated prior shifts, every open advisory re-projects against the new distribution, and the diff is auditable.

Third, the exposure model is a first-class input, not a footnote. If the estate enables peer-to-peer inspection, the projector recomputes CVE-2018-0138 from 0.09 to 0.34 without a human editing a spreadsheet.

What the case study changed operationally

The team that ran this projector against their real estate made three changes the following week. They moved ASA SSL VPN termination behind an identity-aware proxy the day the projector flagged CVE-2018-0101-class exposure at the top of the queue. They opened a detection-engineering ticket for CVE-2017-3822-style audit-log injection with a concrete Sigma rule attached. And they closed the DoS cluster with a documented risk acceptance signed by the network owner — the projector's 90-day probability for that cluster fell below the team's published action threshold, and compensating rate-limits were already in place.

None of those outcomes required a new tool. They required a projector that refused to treat a missing score as a missing risk, and a queue that ranked work by the probability of harm rather than the tidiness of the input feed.

Verifiable security.